Many of the files have been digitally signed using GnuPG. If so,
there will be an accompanying file.asc signature
file in the same directory as the file (binaries/ or source/). The
signing keys can be found in the distribution directory at <http://www.apache.org/dist/commons/KEYS>.

Always download the KEYS file directly from the Apache site, never from a mirror site.